SecurityOnlineDo Son
N-able patches seven N-central flaws as attackers scan servers
Part of the CVE-2026-125883 story · since 9 Nov
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers. This article, 2nd of 5.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
N-able released N-central 2026.4 HF2 on 10 November 2026 to patch seven disclosed vulnerabilities in the N-central platform. The company reports that attackers have begun scanning exposed servers using public proof-of-concept code tied to the Able2Shell flaws, though no successful exploits have been confirmed to date.
The update addresses seven CVEs, with the highest severity at 9.3 under CVSS v4.0 for CVE-2026-125883, described as multiple XML External Entity (XXE) bugs, and CVE-2026-125881, a server-side request forgery in the service import schema validation. N-able notes that activity observed so far is limited to scanning, and that a follow-up hotfix will be released.
The disclosed flaws affect on-premises N-central builds prior to 2026.4 HF2 and hosted (NCOD) instances, which have already been upgraded in the Americas, APAC and Europe.
Notable CVEs include CVE-2026-125883 (XXE), CVE-2026-125881 (SSRF via schema validation), CVE-2026-125878 (OGNL injection enabling code execution with low privileges), CVE-2026-125882 (RCE via file repository upload path traversal), CVE-2026-125879 (root-level privilege escalation via a writable syslog-ng config), CVE-2026-91000 (insecure IPC channels enabling escalation), and CVE-2026-125880 (stored XSS in MMS3 patch metadata in admin context).
N-able directs on-premises customers to upgrade to 2026.4 HF2 as soon as possible, and to review admin accounts and file uploads for signs of abuse after patching. Hosted customers were reportedly upgraded by 01:04 UTC on 11 November 2026.
How the story developed
5 articles from 5 outlets since 9 Nov. Still developing; the latest report was 3 hours ago. This was the 2nd report, 1 day after the first.
- Mon 9 Nov, 22:46 UTC. cybersixt, first report. N-able N-central hotfix hit by new public zero-day exploits.
- Wed 11 Nov, 10:30 UTC. SecurityOnline, its first report on the story. N-able patches seven N-central flaws as attackers scan servers. This article, 2nd of 5.
- Wed 11 Nov, 18:00 UTC. Infosecurity, its first report on the story. N-able patches N-central after 33 exploit proofs go public.
- Wed 11 Nov, 21:00 UTC. Dark Reading, its first report on the story. N-able takes N-central offline after 33 flaws are disclosed.
- Thu 12 Nov, 10:30 UTC. SecurityWeek, its first report on the story. Attackers Probe N-able N-central Zero-Days After Disclosure.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 5 articles as a listHide the list
- Mon 9 NovDay 01
- N-able N-central hotfix hit by new public zero-day exploits22:46 · cybersixt · First report
- Wed 11 NovDay 23
- N-able patches seven N-central flaws as attackers scan servers10:30 · SecurityOnline · This article, 2nd of 5
- N-able patches N-central after 33 exploit proofs go public18:00 · Infosecurity
- N-able takes N-central offline after 33 flaws are disclosed21:00 · Dark Reading
- Thu 12 NovDay 31
- Attackers Probe N-able N-central Zero-Days After Disclosure10:30 · SecurityWeek